auth_time claim doesn't show the time of the original authentication.

[peter-san]

Describe the bug

auth_time claim doesn't show the time of the original authentication. But the time when session was updated.

To Reproduce

Log in using the authorization code grant.

Request several ID tokens, one after another.

The value of the 'auth_time' claim differs in each response and does not show the login time.

Expected behavior

'auth_time' claim represents the time of the original authentication.

[jgrandja]

@peter-san I was not able to reproduce the issue as the auth_time claim remained the same for each OIDC flow I went through while staying logged in.

Please provide a minimal sample or test that reproduces this issue so I can look into it further.